[PATCH 3/3] content editing, deletion of earlier AppleTalk rule, added HIDS rule

David Smith dsmith at eclipse.ncsc.mil
Wed Oct 10 20:29:58 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/system/auditing.xml           |    9 ++++-----
 RHEL6/input/system/network/uncommon.xml   |   17 -----------------
 RHEL6/input/system/software/integrity.xml |   15 +++++++++++++++
 3 files changed, 19 insertions(+), 22 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index a715d2e..c53d16e 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -648,12 +648,11 @@ audited.</rationale>
 
 <Rule id="audit_logs_rootowner">
 <title>System Audit Logs Must Be Owned By Root</title>
-<description>Change the ownership of the audit log file(s) with the following:
-<pre># chown root <i>audit log file</i></pre>
+<description>
+<fileowner-desc-macro file="/var/log" owner="root"/>
 </description>
-<ocil clause="there are log files with an owner other than root">
-To determine the location and ownership of audit log files, run the following command:
-<pre># grep "^log_file" /etc/audit/auditd.conf|sed s/^[^\/]*//|xargs stat -c %U:%n</pre>
+<ocil>
+<fileowner-check-macro file="/var/log" owner="root"/>
 </ocil>
 <rationale>Failure to give ownership of the audit log file(s) to root allows the designated 
 owner, and unauthorized users, potential access to sensitive information.</rationale>
diff --git a/RHEL6/input/system/network/uncommon.xml b/RHEL6/input/system/network/uncommon.xml
index 4d9fec5..902ddce 100644
--- a/RHEL6/input/system/network/uncommon.xml
+++ b/RHEL6/input/system/network/uncommon.xml
@@ -12,23 +12,6 @@ in your network environment by ensuring they are not needed
 prior to disabling them.
 </warning>
 
-<Rule id="disable_protocol_appletalk" severity="medium">
-<title>Disable AppleTalk Support</title>
-<description>
-The AppleTalk protocol suite is no longer in common use.
-<module-disable-macro module="appletalk" />
-</description>
-<ocil>
-<module-disable-check-macro module="appletalk" />
-</ocil>
-<rationale>
-Disabling AppleTalk protects
-the system against exploitation of any flaws in its implementation.
-</rationale>
-<ident cce="14268-7" />
-<ref nist="CM-6, CM-7" disa="382"/>
-</Rule>
-
 <Rule id="disable_protocol_dccp" severity="medium">
 <title>Disable DCCP Support</title>
 <description>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index 28781e2..371b024 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -25,6 +25,21 @@ configurable, with further configuration information located in
 <tt>/usr/share/doc/aide-<i>VERSION</i></tt></description>
 <ref disa="374,1069,1297,1589"/>
 
+<Rule id="install_hids">
+<title>System Must Have a Host-Based Intrusion Detection Tool Installed </title>
+<description>
+Install a Host-Based Intrusion Detection Tool
+</description>
+<ocil clause="no host-based intrusion detection systems are installed">
+The preferred host-based intrusion detection system is the McAfee HBSS product.
+<package-check-macro package="mfehiplsm"/>
+</ocil>
+<rationale>
+Host-based intrusion detection tools allow for system-level intrusion defense. 
+</rationale>
+<ref disa="1263"/>
+</Rule>
+
 <Rule id="install_aide">
 <title>Install AIDE</title>
 <description>
-- 
1.7.1



More information about the scap-security-guide mailing list